fix: use Kaniko --snapshot-mode=redo to fix apt GPG errors in CI

Kaniko's default full-filesystem snapshots corrupt GPG verification
state, causing "invalid signature" errors during apt-get update on
Debian bookworm (node:24-slim). Using --snapshot-mode=redo avoids
this by recalculating layer diffs instead of taking full snapshots.

Also keeps the rm -rf /var/lib/apt/lists/* guard in Dockerfiles as
a defense-in-depth measure against stale base-image APT metadata.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.woodpecker/api.yml

@@ -154,7 +154,7 @@ steps:
         elif [ "$CI_COMMIT_BRANCH" = "develop" ]; then
           DESTINATIONS="--destination git.mosaicstack.dev/mosaic/stack-api:dev"
         fi
-        /kaniko/executor --context . --dockerfile apps/api/Dockerfile $DESTINATIONS
+        /kaniko/executor --context . --dockerfile apps/api/Dockerfile --snapshot-mode=redo $DESTINATIONS
     when:
       - branch: [main, develop]
         event: [push, manual, tag]